Facebook kills ‘Lecpetex’ botnet that turned 250k PCs into Litecoin-mining zombies
Facebook said police in Greece made two arrests last week in connection with a little-known spamming botnet called “Lecpetex,” which used hacked computers to mine the Litecoin virtual currency.
Context & Ripple Effects
Facebook’s role in botnet response has been building: it previously worked with the FBI on a cybercrime case, while an earlier report cast the platform as a distribution channel for botnet activity. The Lecpetex action pairs platform disruption with Greek police arrests rather than treating abusive accounts as an isolated moderation problem.
The ZeroAccess disruption also illustrated the limit of a technical takedown alone: breaking a botnet’s operation is not necessarily the same as eliminating the operators behind it. Lecpetex matters because its compromised PCs were being monetized through Litecoin mining, not only spam or click fraud.
First-order effects
- Greek police arrests and Facebook’s disruption cut off Lecpetex operators from a network of 250,000 compromised PCs used for spam and Litecoin mining.
- Affected PC owners lose an active unauthorized mining workload, while Facebook removes a source of botnet-driven spam from its service.
Second-order effects
- Lecpetex operators face a coordinated enforcement model in which Facebook’s abuse controls are coupled with criminal investigation, raising the cost of rebuilding the operation on the same platform.
- Facebook’s security team gains a concrete case for linking spam enforcement to law-enforcement referrals, following its earlier cooperation with the FBI on cybercrime.
Third-order effects
- If platforms continue to pair account disruption with arrests, botnet defense shifts from repeatedly blocking malicious traffic toward identifying and pursuing the people monetizing infected machines.
- Lecpetex indicates that botnet economics are broadening beyond advertising fraud: compromised PCs can be directed toward virtual-currency mining when operators find it profitable.
The trend: Botnet enforcement is moving toward joint platform-and-police actions aimed at both the infrastructure and the monetization behind compromised-device networks.